A model of the unique online behaviors of ad-hoc extremist groups like ISIS points the way to potential countermeasures against their attacks. | Flickr/ Sebastian / CC BY-NC 2.0
Researchers have developed a way to model the behavioral patterns of online supporters of the Islamic State and use it to predict conditions that may spur real-world attacks. The model shows that when groups of ISIS supporters increase in number and size on the internet, conditions for an attack are more likely. The study appears in the 16 June issue of Science.
"The fact that the number of pro-ISIS groups, or aggregates, proliferates in a specific mathematical way preceding bursts of recent real-world attacks means that monitoring such proliferation can help predict when conditions are ripe for these events," explained co-author Stefan Wuchty, an associate professor in the department of computer science at the University of Miami, Florida.
"Up to now," Wuchty continued, "it was assumed that support for these groups arises from online contagion by which one person influences another, and so forth — a concept that motivates researchers to look at the spread of chatter in individual Tweets among individual users, but we find that the potential power lies in the aggregates."
Wuchty said that a key implication of this discovery "is that once the pro-ISIS aggregates are found online, you have your hand on the pulse of the entire organization." This means that instead of having to sift through millions of internet users to track specific individuals, anti-ISIS agencies can simply follow the relatively small number of aggregates.
To confirm the effectiveness of the model, the researchers investigated the online behavior of pro-ISIS and other terrorist groups leading up to several violent events in recent years, finding that the method would have successfully predicted an onset of social unrest in Brazil in 2013 known as the "Brazil Winter," and a 2014 assault by ISIS in Syria known as the Siege of Kobanî.
"Our model of measuring the time interval until a new aggregate appears on a social network site allowed us to make those predictions," Wuchty said. "The ultimate test would be to make such predictions in real time."
Today, increased connectivity that the internet affords terrorist groups expands their reach, even inspiring individuals with no known history of extremism to operate on their own. Omar Mateen, the gunman in the tragic mass shooting in an Orlando nightclub on 12 June, may have been a self-radicalized extremist, authorities say. Addressing the nation from the White House following the Orlando attack, President Obama said, "It appears that the shooter was inspired by … extremist information that was disseminated over the internet."
Despite the power that the self-organized internet creates, the behavioral mechanisms that sustain it are not well understood. To gain further insights, researchers including Wuchty scrutinized detailed records of online support for ISIS, focusing on pro-ISIS aggregates, and specifically groups of followers of pro-ISIS pages created through VKontakte — the largest social networking service in Europe.
"The fact that the number of pro-ISIS groups, or aggregates, proliferates in a specific mathematical way preceding bursts of recent real-world attacks means that monitoring such proliferation can help predict when conditions are ripe for these events."
Stefan Wuchty
Through a series of data analyses and refinements, they identified 196 pro-ISIS aggregates, studying when these aggregates shut down in response to online pressure from "cyber police," among other behaviors.
Their data show that, even though these pro-ISIS groups comprise members who have likely never met, they display a striking ability to adapt in a way that can extend their online lifetime and increase their size. "A group may disappear but then reappear again with a different name to distract any moderators that were following it," Wuchty said. "Or groups may get shut down but other aggregates will appear and collect the majority of followers through other channels."
Wuchty explained that the patterns did not appear to be supervised. "If a group gets shut down," he said, "somebody takes initiative to set up another page and reconnect the original followers."
Online groups of civil protesters studied as a control group did not exhibit this same adaptive ability, perhaps because in their online environment, there are fewer pressures imposed by outside forces.
Critically, the aggregate size variations Wuchty and colleagues observed among pro-ISIS groups — as they were shut down and then restarted, for example — exhibited a precise pattern characterized by a distinctive shark-fin shape, the researchers say. The pattern captured the group expanding its followers, creating the upward "curved side" of the fin, and abruptly dropping down when the group disbanded.
The model Wuchty and colleagues developed could help groups and organizations fighting ISIS to put in place programs to blunt the growth of large online groups of ISIS sympathizers and limit them to small social media groups. The model can also be used to show when fragmentation rates of pro-ISIS groups by anti-ISIS agencies drop below a critical value. "When aggregate shutdown rates drop below a certain level," Wuchty said, "it becomes possible for any piece of pro-ISIS material to spread globally across the internet."
Moving forward, Wuchty and colleagues plan to further test their method, developing it into one that can be used routinely. They also plan to use their model to further understand the ways propaganda is disseminated — whether it is "spread like a virus or travels like a dollar note."
While the model cannot predict when individuals will go from thinking radical thoughts to acting on them, Wuchty said the results do provide an understanding of 'lone wolf' activity. "Because of the coalescence we see in aggregates," he said, "a lone-wolf won't be 'lone' for very long."